CVE-2025-6514
OS command injection in mcp-remote when connecting to untrusted MCP servers
概要
OS command injection in mcp-remote when connecting to untrusted MCP servers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory research.jfrog.com
- patch github.com
- web registry.npmjs.org
- web jfrog.com